Messages

1

General Discussion / Re: About Business License

« on: April 23, 2024, 06:25:04 pm »

Now that I'm seeing this message, I don't know whether to wait for version 24

AFAIK the 23.7 license key will also work for 24.x so there is no need to wait. I just got an additional license checked out and it took 1 minute. Now on 23.7.x business I do not expect the key to die when 24.x business releases.

2

General Discussion / Re: os-rfc2136 - documentation?

« on: August 14, 2023, 03:27:27 pm »

+1

Using both the dyndns plugin and the acme validation method for RFC2136. It is an important feature to us.

3

22.1 Legacy Series / Re: Major update 22.1.b_141 to 22.1.b3: no signature found

« on: December 28, 2021, 07:05:03 am »

What part of the update process fails for you ?

Mine seems to work. Downloads all, unpacks and installs/reinstalls package but reboots back into 22.1.b_141 and then offers me the update again. Default repo, Development branch.


Package name    Current version    New version    Required action    Repository
packages   22.1.b_141   22.1.b3   upgrade   OPNsense

4

21.1 Legacy Series / Re: 21.1.8 os-tor - TOR service, no longer advertises directory port

« on: July 08, 2021, 09:01:06 am »

The port was not changed. The only thing in the hotfix was a little issue in a diagnostics page.

On the topic of diagnostics page: For 21.1.8 the Diagnostics and info pages are blank for me.

5

21.1 Legacy Series / Re: 21.1.8 os-tor - TOR service, no longer advertises directory port

« on: July 08, 2021, 08:53:40 am »

Super strange... I checked the

Code: [Select]

/usr/local/etc/tor/torrc
And it is right there as it should be:

Code: [Select]

DirPort 8080

6

21.1 Legacy Series / Re: 21.1.8 os-tor - TOR service, no longer advertises directory port

« on: July 08, 2021, 08:46:03 am »

Strange. I update two more Opnsense 21.1.7 -> 21.1.8 and they also stopped publishing DirPort.

I now have 3 out of 4 TOR relays on 21.1.8, one is still on 21.1.7. Settings in OPNsense are:

(see attached)

You can see here the upgraded nodes all stopped publishing DirPort:

(see attached)

I changed settings by changing to a different port number and back to 8080 to try force it to rewrite the config. Also rebooted. No dice. All nodes that upgraded to 21.1.8 lost DirPort.

Edit: Somehow the screenshots I embedded had weird scaling issues. Attached the .png instead

7

21.1 Legacy Series / 21.1.8 os-tor - TOR service, no longer advertises directory port

« on: July 07, 2021, 02:47:48 pm »

Upgrading from 21.1.7 to 21.1.8 updates the tor plugin. After updating and rebooting I notice that the Directory Port is no longer advertised. Has anyone else seen this today ?

I can see that metrics.torproject.org shows "0" for my directory port. In the config in OpnSense it is set correctly. Did not touch the config. Only change I initiated was 21.1.7 to 21.1.8 update.

8

21.1 Legacy Series / Re: Native IPv6, in rules on WAN OK, but nothing connects unless pfctl -d

« on: June 21, 2021, 07:45:16 am »

And the change to OPNsense is every little trouble worth...

100%. Enjoying it so far. Only thing holding me back is https://github.com/opnsense/plugins/issues/1972 BGP and it is a bit worrying that under "Advanced Options" in places where you could put a configuration blob to overcome UI limitations they state

This option will be removed in the future due to being insecure by nature. In the mean time only full administrators are allowed to change this setting.

But there are things that would break horribly the moment you take away that box, i.e. https://github.com/opnsense/core/issues/2048

9

21.1 Legacy Series / Re: Native IPv6, in rules on WAN OK, but nothing connects unless pfctl -d

« on: June 21, 2021, 07:35:11 am »

Firewall > Settings > Advanced > Disable reply-to [check]

Dude!!! I am up!

The crossover from pfSense to OPNsense is full of pitfalls LOL. Thank you so much!

Why is this a thing though and why only in some environments ? I set up a few OPNsense migrations this month and only now came across this.

10

21.1 Legacy Series / Re: Native IPv6, in rules on WAN OK, but nothing connects unless pfctl -d

« on: June 21, 2021, 06:13:11 am »

Just noticed there is a 21.1.7_1 point release out.

Release notes don't show anything that could be related to my issue but I thought I might get lucky. 

I applied it and although it didn't ask me to I rebooted for good measure. Issue persists.

11

21.1 Legacy Series / Native IPv6, in rules on WAN OK, but nothing connects unless pfctl -d

« on: June 21, 2021, 06:01:52 am »

Hey all,

Super weird. I have installed OPNsense 21.1.7 on bare metal. IPv4 and IPv6 WAN assignments are static /29  and /64. IPv6 gateway is the ::1 of my /64. IPv6 WAN address is the ::2 of my IPv6 prefix.

I.e. WAN address: 2001:DB8:1212:3000::2/64, Gateway address 2001:DB8:1212:3000::1

OPNsense can make outbound connections over IPv6 just fine. But inbound only ICMP works.

For testing, I disabled Block Bogons and Block Private on WAN. Now I made some inbound rules on WAN:

allow ICMP (v4/v6) from any
allow TCP/22, TCP/443 IPv4 from an alias and log it.
allow TCP/22, TCP/443 IPv6 from an alias and log it.

I checked the alias table and it has been populated with the expected IPv6 addresses.

Now when I connect from a whitelisted address to OPNsense over IPv6 on tcp/443 or tcp/22 I can see the firewall logging the allow. But no connectivity can take place.

It just times out.

For testing I took everything out of the equation, no blocking of RFC1918, no blocking of BOGON, and put an allow rule as my very first firewall rule on WAN to allow IPV6 proto any from any.

Not sure how to scale this screenshot for the forum, so have attached the jpg below, too:


Again I can now ping OPNsense but NOT connect ssh or https over IPv6.

As a final measure to see if this is perhaps an upstream issue of sorts I ssh in (via IPv4) and do

Code: [Select]

pfctl -d
At that point IPv6 connections are accepted. I can SSH / https to the box over IPv6! How ? Why ? Whiskey Tango Foxtrot?

Attached a sanitized packet capture where I try to ssh from 2604:aa10:9211:2:68c2:f15e:579d:af88 to the WAN address. It shows the pass rule on WAN is working but then things break when OPNsense is trying to reply.

Gateway status shows up, OPNsense can initiate IPv6 conversations successfully. I do not get it.